diff --git a/runsc/boot/restore.go b/runsc/boot/restore.go index 8e0d3da2c..1853a317d 100644 --- a/runsc/boot/restore.go +++ b/runsc/boot/restore.go @@ -362,6 +362,21 @@ func validateResources(field, cName string, oldR, newR *specs.LinuxResources) er return nil } +func copyNamespaceArr(namespaceArr []specs.LinuxNamespace) []specs.LinuxNamespace { + arr := make([]specs.LinuxNamespace, 0, len(namespaceArr)) + for _, n := range namespaceArr { + // Namespace path can change during restore. + arr = append(arr, specs.LinuxNamespace{Type: n.Type}) + } + return arr +} + +func validateNamespaces(field, cName string, oldN, newN []specs.LinuxNamespace) error { + oldArr := copyNamespaceArr(oldN) + newArr := copyNamespaceArr(newN) + return validateArray(field, cName, oldArr, newArr) +} + func validateStruct(field, cName string, oldS, newS any) error { if !reflect.DeepEqual(oldS, newS) { return validateError(field, cName, oldS, newS) @@ -422,7 +437,7 @@ func validateSpecForContainer(oldSpec, newSpec *specs.Spec, cName string) error if err := validateArray("GIDMappings", cName, oldLinux.GIDMappings, newLinux.GIDMappings); err != nil { return err } - if err := validateArray("Namespace", cName, oldLinux.Namespaces, newLinux.Namespaces); err != nil { + if err := validateNamespaces("Namespace", cName, oldLinux.Namespaces, newLinux.Namespaces); err != nil { return err } diff --git a/runsc/container/container_test.go b/runsc/container/container_test.go index b90c4b91d..bbba6ac1f 100644 --- a/runsc/container/container_test.go +++ b/runsc/container/container_test.go @@ -3697,7 +3697,7 @@ func TestSpecValidation(t *testing.T) { wantErr: "Devices does not match across checkpoint restore", }, { - name: "Namespace", + name: "NamespaceFail", mutate: func(spec, restoreSpec *specs.Spec, _, _ string) { spec.Linux = &specs.Linux{} restoreSpec.Linux = &specs.Linux{} @@ -3708,6 +3708,22 @@ func TestSpecValidation(t *testing.T) { }, wantErr: "Namespace does not match across checkpoint restore", }, + { + name: "NamespaceSuccess", + mutate: func(spec, restoreSpec *specs.Spec, _, _ string) { + spec.Linux = &specs.Linux{} + spec.Linux.Namespaces = append(spec.Linux.Namespaces, specs.LinuxNamespace{ + Type: "network", + Path: fmt.Sprintf("/proc/%d/ns/net1", os.Getpid()), + }) + restoreSpec.Linux = &specs.Linux{} + restoreSpec.Linux.Namespaces = append(restoreSpec.Linux.Namespaces, specs.LinuxNamespace{ + Type: "network", + Path: fmt.Sprintf("/proc/%d/ns/net2", os.Getpid()), + }) + }, + wantErr: "", + }, { name: "Seccomp", mutate: func(spec, restoreSpec *specs.Spec, _, _ string) {